Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Servers:

  • DALCON2 (Windows 2008R2, DC, NPS)
  • DALCON3 (Windows 2008R2, DC)
  • DALCON-WWW (Ubuntu server)

Goal:

From DALCON-WWW, using adLDAP with TLS to connect to a domain controller LDAP service

If I connect to DALCON2, I get: Server returned an error: [2] ldap_start_tls(): Unable to start TLS: Server is unavailable. If I connect do DALCON3, it works.

DALCON2 has a Network Policy Service (NPS) enabled to manage VPN connections. Nothing is specificly "denied" in the policies. The LDAP port is open and will respond if not using TLS, but it's unusable (stronger authentification required). I didn't find anything related to LDAP or TLS in NPS.

What might be wrong with DALCON2 that I can't connect to it?

edit

I got more debug infos:

Warning: ldap_start_tls(): Unable to start TLS: Server is unavailable in /var/www/dalcon-inc.com/dev/test/test_ldap.php on line 12

Error Binding to LDAP: 00002028: LdapErr: DSID-0C0901FC, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v1db1

edit

in the Group Policy Management Editor: Computer Configuration, Policies, Windows Settings, Security Settings, and Local Policies, and then click Security Options. In the right pane, double-click the Domain Controller: LDAP server signing requirements policy.

while setting it to "none",
DALCON2:
Plain: OK
SSL: Error Binding to LDAP: Error in the push function. / A TLS packet with unexpected length was received.
TLS: Warning: ldap_start_tls(): Unable to start TLS: Server is unavailable

DALCON3
Plain: OK
SSL: OK
TLS: OK

** edit**

DALCON3 is an exchange 2010 server with a valid SSL certificate

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Found it!

I had to install my SSL certificate in IIS on DALCON2. I exported it from DALCON3 in .pfx format and imported it back. iisreset et voilà!

share|improve this answer
1  
Nice find, that is certainly a bitch to track down. –  SpacemanSpiff Mar 23 '12 at 5:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.